Is CVE-2026-42551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42551 being exploited in the wild.

How severe is CVE-2026-42551?

High severity, with a CVSS score of 7.5, published 13 May 2026.

Which products and versions are affected?

FlightPHP Flight < 3.18.1; flightphp/core (Packagist) < 3.18.1, ECOSYSTEM:introduced=0,fixed=3.18.1.

Is there a fix for CVE-2026-42551?

Yes. flightphp/core (Packagist): upgrade to 3.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42551 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42551?

Check whether you run FlightPHP Flight or flightphp/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42551: Flight PHP HTTP method override in Request::getMethod

Q: Which products and versions are affected?

FlightPHP Flight < 3.18.1; flightphp/core (Packagist) < 3.18.1, ECOSYSTEM:introduced=0,fixed=3.18.1.

Q: Is there a fix for CVE-2026-42551?

Yes. flightphp/core (Packagist): upgrade to 3.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42551 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-42551?

Check whether you run FlightPHP Flight or flightphp/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42551 · Severity: high · CVSS 7.5 · Published 2026-05-13

The Flight PHP framework contains a vulnerability where it incorrectly processes web requests by allowing them to be 'redefined' as different actions (like changing a view request into a delete request). This could allow an attacker to perform destructive actions on a website, such as deleting data, by tricking a user's browser or bypassing security filters. This impact can lead to unauthorized data modification and potential service disruption.

Technologies: FlightPHP Flight, flightphp/core (Packagist). Vendors: FlightPHP, Packagist.

Quick answers

Is CVE-2026-42551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42551 being exploited in the wild.
How severe is CVE-2026-42551?: High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?: FlightPHP Flight < 3.18.1; flightphp/core (Packagist) < 3.18.1, ECOSYSTEM:introduced=0,fixed=3.18.1.
Is there a fix for CVE-2026-42551?: Yes. flightphp/core (Packagist): upgrade to 3.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42551 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42551?: Check whether you run FlightPHP Flight or flightphp/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

flightphp/core (Packagist): upgrade to 3.18.1 or later
```
composer require flightphp/core:^3.18.1
```

Technical details

The `Request::getMethod()` function in `flight/net/Request.php` unconditionally honors the `X-HTTP-Method-Override` header and the `$_REQUEST['_method']` parameter. Because `$_REQUEST` can include parameters from GET requests, an attacker can trigger unsafe HTTP methods (PUT, DELETE, PATCH) using a simple GET request. This facilitates Cross-Site Request Forgery (CSRF) without requiring JavaScript, as a simple `<img>` tag can trigger a destructive action. Additionally, this behavior can be used to bypass middleware that only inspects unsafe verbs or to cause CDN cache poisoning. The issue is fixed in version 3.18.1 by introducing the `flight.allow_method_override` setting, which is disabled by default.

Affected products

flightphp core < 3.18.1

Identifiers

CVE-2026-42551
GHSA-vxrr-w42w-w76g

Timeline

2026-04-29: disclosed: Initial disclosure to flightphp/core
2026-05-06: advisory: GitHub Advisory published
2026-05-13: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.